Green ITADUK IT recycling directory
Menu
Guide for businesses

Data wiping and destruction standards explained

What the NCSC’s sanitisation guidance, NIST SP 800-88 Rev. 2, ADISA’s schemes and older labels such as “IS5 compliant” mean when a company says it will wipe or destroy your drives.

Checked 7 October 2026 · Sources

A hard disk drive with its case broken open and the platter bent out of shape
A physically destroyed hard drive · Photo: Jaroslaw B, CC BY-SA 4.0

The UK government guidance

The National Cyber Security Centre’s guidance, “Secure sanitisation of storage media” (version 2.0, reviewed February 2025), is the current UK government advice. The main points:

  • Treat any device that might contain storage as needing sanitisation — including printers, copiers, routers and smart devices.
  • Encrypted devices: a manufacturer’s factory reset that destroys the encryption keys gives a satisfactory level of assurance for most devices before reuse or sale.
  • Unencrypted devices: overwrite all user-accessible storage, check for remapped or bad sectors, and then read back the whole device to verify that the overwrite worked.
  • Where data may remain, or the data was more sensitive: erase first, then physically destroy the media to particles of 6 mm or less, and check the particle size.
  • Degaussing works only on magnetic media, and only if the degausser is strong enough. It doesn’t work on SSDs or flash memory.
  • When choosing a disposal company, look for recognised certifications or standards, such as ADISA.

Read the NCSC guidance in full.

The NCSC’s assurance scheme has changed

The NCSC’s assured sanitisation scheme, CAS-S, closed on 5 January 2026. It has been replaced by “Sanitisation Service Assurance”, delivered through the Cyber Resilience Test Facilities. Existing CAS-S certificates stay valid until they expire.

NIST SP 800-88 Rev. 2

Many erasure tools quote the US standard NIST SP 800-88, “Guidelines for Media Sanitization”. It was revised in September 2025: Rev. 2 replaced Rev. 1, which was withdrawn on 26 September 2025. Rev. 2 keeps three levels:

  • Clear — a logical overwrite or reset, which protects against simple recovery.
  • Purge — makes recovery infeasible even with laboratory techniques while leaving the media usable: for example built-in sanitise commands, block erase or cryptographic erase.
  • Destroy — shredding, disintegrating, pulverising, melting or incinerating.

Rev. 2 no longer lists techniques for each type of media; it points to the IEEE 2883 standard for those. It warns that multi-pass overwrites give little assurance on SSDs, and it recommends verification and a certificate of sanitisation for each item.

ADISA’s certifications

ADISA Certification runs several schemes:

  • ICT Asset Recovery Standard 8.0 — an ICO-approved UK GDPR certification with ongoing audits. Certified companies are given a DIAL (Data Impact Assurance Level) rating.
  • ITAD Essentials — an annual certification graded Gold, Silver or Bronze. It isn’t government-recognised.
  • Product Claims Test and Product Assurance — laboratory tests of erasure tools against NIST 800-88 or IEEE 2883.
  • VIZION — verification of shredded particle size.

The ADISA register lists certified companies, those under application, and those whose certification has lapsed or been withdrawn. An “ADISA member” badge or logo is not the same as being certified.

What about “IS5 compliant”?

HMG Information Assurance Standard No. 5 (IS5) was the old UK government sanitisation standard; its last issue dates from 2011, and the NCSC’s current guidance doesn’t refer to it. Treat “IS5 compliant” as a reference to an outdated standard, and ask what method is actually used, whether it is verified, and whether you get a certificate for each item.

What to ask a provider

  • Which guidance or standard do you follow — NCSC, NIST SP 800-88 Rev. 2, IEEE 2883?
  • Is every erasure verified?
  • What happens to drives that fail erasure or can’t be wiped? Are they destroyed to a stated particle size, such as 6 mm or less?
  • Do I get a certificate for each serial number?

There are more questions in our checklist. Find companies offering data erasure, hard drive shredding or degaussing.

Sources

  1. NCSC: Secure sanitisation of storage media
  2. NCSC: Sanitisation assurance scheme (CAS-S)
  3. NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization (September 2025)
  4. NIST SP 800-88 Rev. 1 (withdrawn 26 Sep 2025)
  5. ADISA Certification: assurance levels
  6. ADISA Certification: ICT Asset Recovery Standard 8.0
  7. ADISA Certification: search for a certified company

This guide is general information, not legal advice. Rules differ between England, Wales, Scotland and Northern Ireland — check with the regulator or an adviser for your situation.